chore: fix npm audit woes #438
Closed
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
|
Can you confirm whether its similar to this one or not ? |
|
@anikethsaha Not exactly. The main upgrade here is
I reworked this PR to only relax the audit step a little. All of the vulnerabilities we're seeing now are low-level, and via the Jest dependency. |
* only check production dependencies * don't have low-level vulnerabilities break the build * output parseable format to avoid huge ANSI art log
|
Should be fixed now... Turns out |
| @@ -21,7 +21,7 @@ | |||
| "prebuild": "npm run clean", | |||
| "build": "cross-env NODE_ENV=production babel src -d dist --copy-files", | |||
| "commitlint": "commitlint --from=master", | |||
| "security": "npm audit", | |||
| "security": "npm audit --audit-level=moderate --parseable --production", | |||
There was a problem hiding this comment.
Can you explain? That'll make this patch a full no-op and audit will be broken still.
There was a problem hiding this comment.
Acorn release new version with fixed, we don't need it anymore, just update lock file
There was a problem hiding this comment.
That wouldn't seem to help due to how things are pinned in Jest's JSDOM:
$ rm package-lock.json
$ npm i
added 10 packages from 84 contributors, removed 619 packages, updated 55 packages and audited 894519 packages in 18.582s
found 7 moderate severity vulnerabilities
run `npm audit fix` to fix them, or `npm audit` for details
$ npm audit; npm audit --parseable
=== npm audit security report ===
# Run npm install --save-dev jest@25.1.0 to resolve 7 vulnerabilities
SEMVER WARNING: Recommended action is a potentially breaking change
[... snip ...]
found 7 moderate severity vulnerabilities in 894519 scanned packages
7 vulnerabilities require semver-major dependency updates.
install acorn moderate npm install --save-dev jest@25.1.0 Regular Expression Denial of Service https://npmjs.com/advisories/1488 jest>jest-cli>@jest/core>@jest/reporters>jest-runtime>jest-config>jest-environment-jsdom>jsdom>acorn Y
install acorn moderate npm install --save-dev jest@25.1.0 Regular Expression Denial of Service https://npmjs.com/advisories/1488 jest>jest-cli>@jest/core>jest-runner>jest-jasmine2>jest-runtime>jest-config>jest-environment-jsdom>jsdom>acorn Y
install acorn moderate npm install --save-dev jest@25.1.0 Regular Expression Denial of Service https://npmjs.com/advisories/1488 jest>jest-cli>@jest/core>jest-runner>jest-runtime>jest-config>jest-environment-jsdom>jsdom>acorn Y
install acorn moderate npm install --save-dev jest@25.1.0 Regular Expression Denial of Service https://npmjs.com/advisories/1488 jest>jest-cli>@jest/core>jest-runtime>jest-config>jest-environment-jsdom>jsdom>acorn Y
install acorn moderate npm install --save-dev jest@25.1.0 Regular Expression Denial of Service https://npmjs.com/advisories/1488 jest>jest-cli>@jest/core>jest-runner>jest-config>jest-environment-jsdom>jsdom>acorn Y
install acorn moderate npm install --save-dev jest@25.1.0 Regular Expression Denial of Service https://npmjs.com/advisories/1488 jest>jest-cli>@jest/core>jest-config>jest-environment-jsdom>jsdom>acorn Y
install acorn moderate npm install --save-dev jest@25.1.0 Regular Expression Denial of Service https://npmjs.com/advisories/1488 jest>jest-cli>jest-config>jest-environment-jsdom>jsdom>acorn Y
$
There was a problem hiding this comment.
So @evilebottnawi, what should we do?
There was a problem hiding this comment.
Ignore it, we can't do something here
1 task
|
Done in master, thanks for the PR |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR contains a:
Motivation / Use-Case
Azure Pipelines' audit step has been broken for a while.
This PR relaxes the
securitystep:Breaking Changes
None.
Additional Info